fix(deploy): 补齐集群备份兼容与切换前门禁

阿里云 OSS 的 S3 兼容层要求 virtual-hosted addressing，且 boto3 需要使用 Signature V2。本提交为 Barman 的归档、备份、保留与恢复统一挂载 AWS 配置，并将实际 WAL 归档和近期全备设为切换硬门禁。

同时补充 CNPG/etcdutl 固定版本安装、显式主库切换、三节点逐台停机、OSS 快照下载校验与远端临时 Secret 清理。已通过 ShellCheck、Kustomize、服务端 dry-run、迁移测试、发布脚本测试、敏感信息扫描及生产 precutover 验收。

scripts/cluster/verify-cluster.sh

@@ -53,8 +53,7 @@ REMOTE
 [[ $cluster_state == nodes=3 ]]
 echo 'k3s_control_plane=PASS servers=3 witness_business_pods=0'
 
-if [[ $mode == postcutover ]]; then
-  database_state=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
+database_state=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
 set -euo pipefail
 kubectl='k3s kubectl'
 [[ $($kubectl get cluster easyai-postgres -n easyai -o jsonpath='{.status.readyInstances}') -eq 2 ]]
@@ -62,9 +61,36 @@ primary=$($kubectl get cluster easyai-postgres -n easyai -o jsonpath='{.status.c
 [[ $($kubectl get pod "$primary" -n easyai -o jsonpath='{.spec.nodeName}') == easyai-ningbo ||
    $($kubectl get pod "$primary" -n easyai -o jsonpath='{.spec.nodeName}') == easyai-hongkong ]]
 replication=$($kubectl exec -n easyai "$primary" -c postgres -- \
-  psql -X -U easyai -d easyai_ai_gateway -At -c \
+  psql -X -U postgres -d easyai_ai_gateway -At -c \
   "SELECT count(*) FROM pg_stat_replication WHERE sync_state IN ('sync','quorum');")
 [[ $replication -eq 1 ]]
+archived_count=$($kubectl exec -n easyai "$primary" -c postgres -- \
+  psql -X -U postgres -d postgres -At -c \
+  'SELECT archived_count FROM pg_stat_archiver;')
+(( archived_count > 0 ))
+[[ $($kubectl get cluster easyai-postgres -n easyai \
+  -o jsonpath='{.status.conditions[?(@.type=="ContinuousArchiving")].status}') == True ]]
+completed_backups=$($kubectl get backups -n easyai -o json |
+  jq '[.items[] | select(
+    .spec.cluster.name == "easyai-postgres" and .status.phase == "completed"
+  )] | length')
+(( completed_backups > 0 ))
+for pod in $($kubectl get pods -n easyai -l cnpg.io/cluster=easyai-postgres \
+  -o jsonpath='{.items[*].metadata.name}'); do
+  $kubectl exec -n easyai "$pod" -c postgres -- \
+    test -r /projected/barman-aws/config
+done
+printf 'primary=%s archived=%s backups=%s\n' \
+  "$primary" "$archived_count" "$completed_backups"
+REMOTE
+)
+[[ $database_state == primary=easyai-postgres-* ]]
+echo "postgres_preflight=PASS $database_state synchronous_replicas=1"
+
+if [[ $mode == postcutover ]]; then
+  application_state=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
+set -euo pipefail
+kubectl='k3s kubectl'
 [[ $($kubectl get pods -n easyai -l app.kubernetes.io/name=easyai-api \
   --field-selector=status.phase=Running --no-headers | wc -l) -eq 2 ]]
 [[ $($kubectl get pods -n easyai -l app.kubernetes.io/name=easyai-web \
@@ -82,11 +108,11 @@ fi
   --as=system:serviceaccount:easyai:easyai-ai-gateway) == yes ]]
 [[ $($kubectl auth can-i update secret/easyai-ai-gateway-runtime -n easyai \
   --as=system:serviceaccount:easyai:easyai-ai-gateway) == no ]]
-printf 'primary=%s\n' "$primary"
+printf 'applications=ready\n'
 REMOTE
 )
-  [[ $database_state == primary=easyai-postgres-* ]]
-  echo "postgres_acceptance=PASS $database_state synchronous_replicas=1"
+  [[ $application_state == applications=ready ]]
+  echo 'application_acceptance=PASS api=2 web=2 digests=pinned'
 
   for edge_ip in "${CLUSTER_NINGBO_HOST#*@}" "${CLUSTER_HONGKONG_HOST#*@}"; do
     curl -fsS --max-time 10 --resolve "ai.51easyai.com:443:$edge_ip" \